Detections
Analytics
SCA: security update for com.github.ulisesbocchio:jasypt-spring-boot, com.github.ulisesbocchio:jasypt-spring-boot-starter (GHSA-jgj7-c8vj-w563)
medium Tenable Cloud Security Plugin ID 446749
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- A weakness has been identified in ulisesbocchio jasypt-spring-boot up to 3.0.5/4.0.4. Affected by this
vulnerability is the function getSecretKeySaltGenerator of the file jasypt-spring-
boot/src/main/java/com/ulisesbocchio/jasyptspringboot/encryptor/SimpleGCMConfig.java of the component
Password Hash Handler. Executing a manipulation can lead to use of a one-way hash with a predictable salt.
The attack can be launched remotely. The attack requires a high level of complexity. The exploitation
appears to be difficult. The exploit has been made available to the public and could be used for attacks.
The project was informed of the problem early through an issue report but has not responded yet.
(CVE-2026-9370)
Solution
There is no known solution at this time.See Also
Plugin Details
Severity: Medium
ID: 446749
Version: Revision 1.1
Type: Local
Family: SCA Checks
Published: 8/31/2026
Updated: 8/31/2026
Risk Information
VPR
Risk Factor: Low
Score: 1.2
Percentile: 0.01
Vendor
Vendor Severity: Low
CVSS v2
Risk Factor: Low
Base Score: 2.6
Temporal Score: 1.9
Vector: CVSS2#AV:N/AC:H/Au:N/C:P/I:N/A:N
CVSS Score Source: CVE-2026-9370
CVSS v3
Risk Factor: Low
Base Score: 3.7
Temporal Score: 3.2
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
CVSS v4
Risk Factor: Medium
Base Score: 6.3
Threat Score: 1.7
Threat Vector: CVSS:4.0/E:U
Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 5/26/2026
Vulnerability Publication Date: 5/24/2026
Reference Information
CVE: CVE-2026-9370
cwe: CWE-759